taegis-sdk-python 1.6.16__tar.gz → 1.6.17__tar.gz

{taegis_sdk_python-1.6.16 → taegis_sdk_python-1.6.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: taegis-sdk-python
-Version: 1.6.16
+Version: 1.6.17
 Summary: Taegis Python SDK
 Project-URL: Homepage, https://github.com/secureworks/taegis-sdk-python
 Project-URL: Bug Reports, https://github.com/secureworks/taegis-sdk-python/issues

{taegis_sdk_python-1.6.16 → taegis_sdk_python-1.6.17}/taegis_sdk_python/_version.py

@@ -1,3 +1,3 @@
 """Version idenitier."""
 
-__version__ = "1.6.16"
+__version__ = "1.6.17"

taegis_sdk_python-1.6.17/taegis_sdk_python/commons/__init__.py

@@ -0,0 +1,33 @@
+"""Taegis Commons - Imports."""
+
+from taegis_sdk_python.commons._introspection import (
+    introspection_mutation,
+    introspection_query,
+    introspection_subscription,
+)
+from taegis_sdk_python.commons.alerts.search import alerts_search
+from taegis_sdk_python.commons.cases.search import cases_search
+from taegis_sdk_python.commons.events.search import events_search
+from taegis_sdk_python.commons.investigations.search import investigations_search
+from taegis_sdk_python.commons.sharelinks.create import (
+    create_alerts_query_sharelink,
+    create_cases_sharelink,
+    create_events_query_sharelink,
+    create_investigations_sharelink,
+    create_sharelink,
+)
+
+__all__ = [
+    "introspection_query",
+    "introspection_mutation",
+    "introspection_subscription",
+    "alerts_search",
+    "cases_search",
+    "events_search",
+    "investigations_search",
+    "create_sharelink",
+    "create_alerts_query_sharelink",
+    "create_events_query_sharelink",
+    "create_investigations_sharelink",
+    "create_cases_sharelink",
+]

taegis_sdk_python-1.6.17/taegis_sdk_python/commons/_introspection.py

@@ -0,0 +1,122 @@
+"""Taegis Commons - Introspection GraphQL operations."""
+
+from typing import Any, Optional
+
+from graphql import GraphQLSchema
+
+from taegis_sdk_python import (
+    GraphQLService,
+    build_output_string_from_introspection,
+    prepare_input,
+)
+
+
+def introspection_query(
+    service: GraphQLService,
+    endpoint: str,
+    schema: Optional[GraphQLSchema] = None,
+    **kwargs
+) -> Any:
+    """Generate a GraphQL Query operation with output based on server-side introspection.
+
+    Parameters
+    ----------
+    service : GraphQLService
+    endpoint : str
+    schema : Optional[GraphQLSchema], optional
+        If not provided, the latest schema will be retrieved from the GQL endpoint. By default, None.
+        Useful when the schmea is not on the core service, but is on a child service (e.g. EventService) that shares the same GQL endpoint.
+    Returns
+    -------
+    Any
+        Usually a dict or list of dicts, depending on the query.
+    """
+    # retreive the latest schema from the GQL endpoint
+    if schema is None:
+        schema = service.core.schema
+    # parse the correct output fields for the desired query from the schema
+    field = schema.query_type.fields.get(endpoint)
+
+    output = build_output_string_from_introspection(field)
+
+    results = service.core.execute_query(
+        endpoint=endpoint,
+        variables={key: prepare_input(value) for key, value in kwargs.items()},
+        output=output,
+    )
+
+    return results.get(endpoint)
+
+
+def introspection_mutation(
+    service: GraphQLService,
+    endpoint: str,
+    schema: Optional[GraphQLSchema] = None,
+    **kwargs
+) -> Any:
+    """Generate a GraphQL Mutation operation with output based on server-side introspection.
+
+    Parameters
+    ----------
+    service : GraphQLService
+    endpoint : str
+    schema : Optional[GraphQLSchema], optional
+        If not provided, the latest schema will be retrieved from the GQL endpoint. By default, None.
+        Useful when the schmea is not on the core service, but is on a child service (e.g. EventService) that shares the same GQL endpoint.
+    Returns
+    -------
+    Any
+        Usually a dict or list of dicts, depending on the query.
+    """
+    # retreive the latest schema from the GQL endpoint
+    if schema is None:
+        schema = service.core.schema
+    # parse the correct output fields for the desired query from the schema
+    field = schema.mutation_type.fields.get(endpoint)
+
+    output = build_output_string_from_introspection(field)
+
+    results = service.core.execute_query(
+        endpoint=endpoint,
+        variables={key: prepare_input(value) for key, value in kwargs.items()},
+        output=output,
+    )
+
+    return results.get(endpoint)
+
+
+def introspection_subscription(
+    service: GraphQLService,
+    endpoint: str,
+    schema: Optional[GraphQLSchema] = None,
+    **kwargs
+) -> Any:
+    """Generate a GraphQL Subscription operation with output based on server-side introspection.
+
+    Parameters
+    ----------
+    service : GraphQLService
+    endpoint : str
+    schema : Optional[GraphQLSchema], optional
+        If not provided, the latest schema will be retrieved from the GQL endpoint. By default, None.
+        Useful when the schmea is not on the core service, but is on a child service (e.g. EventService) that shares the same GQL endpoint.
+    Returns
+    -------
+    Any
+        Usually a dict or list of dicts, depending on the query.
+    """
+    # retreive the latest schema from the GQL endpoint
+    if schema is None:
+        schema = service.core.schema
+    # parse the correct output fields for the desired query from the schema
+    field = schema.subscription_type.fields.get(endpoint)
+
+    output = build_output_string_from_introspection(field)
+
+    results = service.core.execute_query(
+        endpoint=endpoint,
+        variables={key: prepare_input(value) for key, value in kwargs.items()},
+        output=output,
+    )
+
+    return results.get(endpoint)

{taegis_sdk_python-1.6.16 → taegis_sdk_python-1.6.17}/taegis_sdk_python/services/alerts/types.py

@@ -35,6 +35,7 @@ class ResolutionStatus(str, Enum):
     NOT_ACTIONABLE = "NOT_ACTIONABLE"
     OTHER = "OTHER"
     SUPPRESSED = "SUPPRESSED"
+    AUTO_CLOSE = "AUTO_CLOSE"
 
 
 class Origin(str, Enum):

{taegis_sdk_python-1.6.16 → taegis_sdk_python-1.6.17}/taegis_sdk_python/services/context_summarizer/__init__.py

@@ -1,8 +1,12 @@
 """ContextSummarizer Service."""
 
 from taegis_sdk_python.service_core import ServiceCore
-from taegis_sdk_python.services.context_summarizer.mutations import TaegisSDKContextSummarizerMutation
-from taegis_sdk_python.services.context_summarizer.queries import TaegisSDKContextSummarizerQuery
+from taegis_sdk_python.services.context_summarizer.mutations import (
+    TaegisSDKContextSummarizerMutation,
+)
+from taegis_sdk_python.services.context_summarizer.queries import (
+    TaegisSDKContextSummarizerQuery,
+)
 from taegis_sdk_python.services.context_summarizer.subscriptions import (
     TaegisSDKContextSummarizerSubscription,
 )

{taegis_sdk_python-1.6.16 → taegis_sdk_python-1.6.17}/taegis_sdk_python/services/investigations2/types.py

@@ -296,15 +296,6 @@ class RemoveEvidenceFromCaseResult:
     )
 
 
-@dataclass_json
-@dataclass(order=True, eq=True, frozen=True)
-class CaseCommentsCount:
-    """CaseCommentsCount."""
-
-    total: Optional[int] = field(default=None, metadata=config(field_name="total"))
-    unread: Optional[int] = field(default=None, metadata=config(field_name="unread"))
-
-
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class CaseDetectionEvidence:
@@ -3596,6 +3587,12 @@ class Case:
     is_created_by_partner: Optional[bool] = field(
         default=None, metadata=config(field_name="isCreatedByPartner")
     )
+    is_created_by_mdr_provider: Optional[bool] = field(
+        default=None, metadata=config(field_name="isCreatedByMDRProvider")
+    )
+    is_created_by_parent: Optional[bool] = field(
+        default=None, metadata=config(field_name="isCreatedByParent")
+    )
     detections_count: Optional[int] = field(
         default=None, metadata=config(field_name="detectionsCount")
     )
@@ -3932,6 +3929,9 @@ class CaseComments:
     total_count: Optional[int] = field(
         default=None, metadata=config(field_name="totalCount")
     )
+    total_unread_count: Optional[int] = field(
+        default=None, metadata=config(field_name="totalUnreadCount")
+    )
     comments: Optional[List[CaseComment]] = field(
         default=None, metadata=config(field_name="comments")
     )

{taegis_sdk_python-1.6.16 → taegis_sdk_python-1.6.17}/taegis_sdk_python/services/process_trees/queries.py

@@ -41,6 +41,9 @@ class TaegisSDKProcessTreesQuery:
         order_by_input: Optional[List[OrderByInput]] = None,
         next_token: Optional[str] = None,
         page_size: Optional[int] = None,
+        max_results: Optional[int] = None,
+        start_date: Optional[str] = None,
+        end_date: Optional[str] = None,
     ) -> Children:
         """No developer notes."""
         endpoint = "processChildren"
@@ -55,6 +58,9 @@ class TaegisSDKProcessTreesQuery:
                 "orderByInput": prepare_input(order_by_input),
                 "nextToken": prepare_input(next_token),
                 "pageSize": prepare_input(page_size),
+                "maxResults": prepare_input(max_results),
+                "startDate": prepare_input(start_date),
+                "endDate": prepare_input(end_date),
             },
             output=build_output_string(
                 Children,

{taegis_sdk_python-1.6.16 → taegis_sdk_python-1.6.17}/taegis_sdk_python/services/tenants4/mutations.py

@@ -51,3 +51,21 @@ class TaegisSDKTenants4Mutation:
         if result.get(endpoint) is not None:
             return DeleteCachedEntriesOutput.from_dict(result.get(endpoint))
         raise GraphQLNoRowsInResultSetError("for mutation deleteCachedEntries")
+
+    def sync_tenant_license_capabilities(self) -> SyncTenantLicenseCapabilitiesOutput:
+        """Enqueue a license capability refresh for the tenant in request context."""
+        endpoint = "syncTenantLicenseCapabilities"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={},
+            output=build_output_string(
+                SyncTenantLicenseCapabilitiesOutput,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return SyncTenantLicenseCapabilitiesOutput.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError(
+            "for mutation syncTenantLicenseCapabilities"
+        )

{taegis_sdk_python-1.6.16 → taegis_sdk_python-1.6.17}/taegis_sdk_python/services/tenants4/types.py

@@ -181,6 +181,19 @@ class LicenseLevel(str, Enum):
     ALL = "ALL"
 
 
+class TenantLicenseCapability(str, Enum):
+    """TenantLicenseCapability."""
+
+    NO_DATA = "NO_DATA"
+    EDR = "EDR"
+    MDR = "MDR"
+    XDR = "XDR"
+    ITDR = "ITDR"
+    NG_SIEM = "NG_SIEM"
+    AI_SECURITY = "AI_SECURITY"
+    MANAGED_RISK = "MANAGED_RISK"
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class MappedTenant:
@@ -333,6 +346,16 @@ class DeleteCachedEntriesOutput:
     message: Optional[str] = field(default=None, metadata=config(field_name="message"))
 
 
+@dataclass_json
+@dataclass(order=True, eq=True, frozen=True)
+class SyncTenantLicenseCapabilitiesOutput:
+    """SyncTenantLicenseCapabilitiesOutput."""
+
+    tenant_id: Optional[str] = field(
+        default=None, metadata=config(field_name="tenantID")
+    )
+
+
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
 class RequestTenantContext:
@@ -574,6 +597,16 @@ class TenantV4:
             field_name="licenseLevel",
         ),
     )
+    license_capabilities: Optional[List[Union[TenantLicenseCapability, TaegisEnum]]] = (
+        field(
+            default=None,
+            metadata=config(
+                encoder=encode_enum,
+                decoder=lambda x: decode_enum(TenantLicenseCapability, x),
+                field_name="licenseCapabilities",
+            ),
+        )
+    )
 
 
 @dataclass_json
@@ -690,6 +723,36 @@ class TenantsQuery:
             field_name="licenseLevel",
         ),
     )
+    license_capabilities_any: Optional[
+        List[Union[TenantLicenseCapability, TaegisEnum]]
+    ] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TenantLicenseCapability, x),
+            field_name="licenseCapabilitiesAny",
+        ),
+    )
+    license_capabilities_all: Optional[
+        List[Union[TenantLicenseCapability, TaegisEnum]]
+    ] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TenantLicenseCapability, x),
+            field_name="licenseCapabilitiesAll",
+        ),
+    )
+    license_capabilities_none: Optional[
+        List[Union[TenantLicenseCapability, TaegisEnum]]
+    ] = field(
+        default=None,
+        metadata=config(
+            encoder=encode_enum,
+            decoder=lambda x: decode_enum(TenantLicenseCapability, x),
+            field_name="licenseCapabilitiesNone",
+        ),
+    )
 
 
 @dataclass_json

{taegis_sdk_python-1.6.16 → taegis_sdk_python-1.6.17}/taegis_sdk_python/services/threat/types.py

@@ -34,6 +34,7 @@ class SortByFieldInput(str, Enum):
     THREAT_GROUP_NAME = "threat_group_name"
     THREAT_GROUP_THEMATIC_AREA = "threat_group_thematic_area"
     THREAT_GROUP_STATUS = "threat_group_status"
+    THREAT_GROUP_LAST_KNOWN_ACTIVITY = "threat_group_last_known_activity"
     REPORT_NAME = "report_name"
     REPORT_PUBLISHED = "report_published"
 
@@ -2310,22 +2311,25 @@ ThreatResult = Union[
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class ThreatFilter:
-    """ThreatFilter."""
+class IndicatorFilter:
+    """IndicatorFilter."""
 
-    where: Optional[ThreatWhereInput] = field(
+    where: Optional[IndicatorWhereInput] = field(
         default=None, metadata=config(field_name="where")
     )
 
 
 @dataclass_json
 @dataclass(order=True, eq=True, frozen=True)
-class IndicatorFilter:
-    """IndicatorFilter."""
+class ThreatFilter:
+    """ThreatFilter."""
 
-    where: Optional[IndicatorWhereInput] = field(
+    where: Optional[ThreatWhereInput] = field(
         default=None, metadata=config(field_name="where")
     )
+    time_range: Optional[ThreatTimeRangeInput] = field(
+        default=None, metadata=config(field_name="timeRange")
+    )
 
 
 @dataclass_json

taegis_sdk_python-1.6.17/taegis_sdk_python/services/threat_context/__init__.py

@@ -0,0 +1,34 @@
+"""ThreatContext Service."""
+
+from taegis_sdk_python.service_core import ServiceCore
+from taegis_sdk_python.services.threat_context.mutations import (
+    TaegisSDKThreatContextMutation,
+)
+from taegis_sdk_python.services.threat_context.queries import (
+    TaegisSDKThreatContextQuery,
+)
+from taegis_sdk_python.services.threat_context.subscriptions import (
+    TaegisSDKThreatContextSubscription,
+)
+
+
+class ThreatContextService(ServiceCore):
+    """Taegis ThreatContext Service."""
+
+    @property
+    def query(self):
+        if not self._queries:
+            self._queries = TaegisSDKThreatContextQuery(self)
+        return self._queries
+
+    @property
+    def mutation(self):
+        if not self._mutations:
+            self._mutations = TaegisSDKThreatContextMutation(self)
+        return self._mutations
+
+    @property
+    def subscription(self):
+        if not self._subscriptions:
+            self._subscriptions = TaegisSDKThreatContextSubscription(self)
+        return self._subscriptions

taegis_sdk_python-1.6.17/taegis_sdk_python/services/threat_context/mutations.py

@@ -0,0 +1,55 @@
+"""ThreatContext Mutation."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.threat_context.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.threat_context import ThreatContextService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKThreatContextMutation:
+    """Taegis Threat_context Mutation operations."""
+
+    def __init__(self, service: ThreatContextService):
+        self.service = service
+
+    def intelix_create_file_submissions(
+        self, input_: ThreatContextIntelixCreateFileSubmissionsInput
+    ) -> ThreatContextIntelixFileSubmissionsResponse:
+        """No developer notes."""
+        endpoint = "intelixCreateFileSubmissions"
+
+        result = self.service.execute_mutation(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(
+                ThreatContextIntelixFileSubmissionsResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return ThreatContextIntelixFileSubmissionsResponse.from_dict(
+                result.get(endpoint)
+            )
+        raise GraphQLNoRowsInResultSetError("for mutation intelixCreateFileSubmissions")

taegis_sdk_python-1.6.17/taegis_sdk_python/services/threat_context/queries.py

@@ -0,0 +1,157 @@
+"""ThreatContext Query."""
+
+# pylint: disable=no-member, unused-argument, too-many-locals, duplicate-code, wildcard-import, unused-wildcard-import, cyclic-import
+
+
+# Autogenerated
+# DO NOT MODIFY
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Tuple, Union
+
+from taegis_sdk_python import GraphQLNoRowsInResultSetError
+from taegis_sdk_python._consts import TaegisEnum
+from taegis_sdk_python.services.threat_context.types import *
+from taegis_sdk_python.utils import (
+    build_output_string,
+    parse_union_result,
+    prepare_input,
+)
+
+if TYPE_CHECKING:  # pragma: no cover
+    from taegis_sdk_python.services.threat_context import ThreatContextService
+
+log = logging.getLogger(__name__)
+
+
+class TaegisSDKThreatContextQuery:
+    """Taegis Threat_context Query operations."""
+
+    def __init__(self, service: ThreatContextService):
+        self.service = service
+
+    def reputation(
+        self,
+        indicators: List[ThreatContextIndicatorInput],
+        cache: Optional[CacheOptions] = None,
+        options: Optional[ReputationOptions] = None,
+    ) -> List[Results]:
+        """No developer notes."""
+        endpoint = "reputation"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "indicators": prepare_input(indicators),
+                "cache": prepare_input(cache),
+                "options": prepare_input(options),
+            },
+            output=build_output_string(
+                Results,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return [parse_union_result(Results, r) for r in result.get(endpoint)]
+        raise GraphQLNoRowsInResultSetError("for query reputation")
+
+    def reputation_summaries(
+        self,
+        indicators: List[ThreatContextIndicatorInput],
+        cache: Optional[CacheOptions] = None,
+    ) -> IndicatorsSummary:
+        """No developer notes."""
+        endpoint = "reputationSummaries"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "indicators": prepare_input(indicators),
+                "cache": prepare_input(cache),
+            },
+            output=build_output_string(
+                IndicatorsSummary,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return IndicatorsSummary.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query reputationSummaries")
+
+    def risky_indicators(self, arguments: RiskyIndicatorArguments) -> List[Results]:
+        """No developer notes."""
+        endpoint = "riskyIndicators"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "arguments": prepare_input(arguments),
+            },
+            output=build_output_string(
+                Results,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return [parse_union_result(Results, r) for r in result.get(endpoint)]
+        raise GraphQLNoRowsInResultSetError("for query riskyIndicators")
+
+    def api_void_stats(self) -> APIVoidStats:
+        """No developer notes."""
+        endpoint = "apiVoidStats"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={},
+            output=build_output_string(
+                APIVoidStats,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return APIVoidStats.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query apiVoidStats")
+
+    def intelix_report(
+        self, input_: ThreatContextIntelixReportInput
+    ) -> ThreatContextIntelixReport:
+        """No developer notes."""
+        endpoint = "intelixReport"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(
+                ThreatContextIntelixReport,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return ThreatContextIntelixReport.from_dict(result.get(endpoint))
+        raise GraphQLNoRowsInResultSetError("for query intelixReport")
+
+    def intelix_get_latest_file_submission(
+        self, input_: ThreatContextIntelixGetLatestFileSubmissionInput
+    ) -> ThreatContextIntelixGetLatestFileSubmissionResponse:
+        """No developer notes."""
+        endpoint = "intelixGetLatestFileSubmission"
+
+        result = self.service.execute_query(
+            endpoint=endpoint,
+            variables={
+                "input": prepare_input(input_),
+            },
+            output=build_output_string(
+                ThreatContextIntelixGetLatestFileSubmissionResponse,
+                exclude_deprecated_output=self.service.exclude_deprecated_output,
+            ),
+        )
+        if result.get(endpoint) is not None:
+            return ThreatContextIntelixGetLatestFileSubmissionResponse.from_dict(
+                result.get(endpoint)
+            )
+        raise GraphQLNoRowsInResultSetError("for query intelixGetLatestFileSubmission")